PT-2026-64444 · Maven · Org.Openidentityplatform.Openam:Openam-Auth-Webauthn

CVE-2026-62263 · Published 2026-07-24 · Updated 2026-07-24

OSV

CVSS v4.0

9.2

Critical

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Summary

The GHSA-6c99-87fr-6q7r fix wrapped WebAuthn authenticator deserialization in an ObjectInputFilter meant to allow only AuthenticatorImpl, but it short-circuits to ALLOWED for any object at stream depth > 1. Because the Java serialization filter is consulted for every class in the graph (and depth == 1 only for the root's concrete class), the allowlist constrains only the root and leaves the entire nested graph unchecked.

Impact

An attacker can craft a stream rooted at AuthenticatorImpl with an arbitrary gadget chain nested inside. The gadget's readObject/readResolve executes during readObject() — before the cast and before any assertion verification — enabling remote code execution when a gadget is on the classpath. The deserialization sink is reached pre-authentication via an attacker-chosen userHandle.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2026-62263

GHSA-GF8H-GQ53-288J

Affected Products

Org.Openidentityplatform.Openam:Openam-Auth-Webauthn

References · 5

• https://osv.dev/vulnerability/GHSA-gf8h-gq53-288j · Vendor Advisory
• https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-gf8h-gq53-288j · Note
• https://github.com/OpenIdentityPlatform/OpenAM · Note
• https://github.com/OpenIdentityPlatform/OpenAM/releases/tag/16.1.2 · Note
• https://github.com/OpenIdentityPlatform/OpenAM/commit/9dd0fbe07f70f118cf45042d3a9ffb32f3c21e08 · Note